GitHub Advisoryadvisory · PyPI

GHSA-9rp8-h4g8-8766 Weblate wlc has insecure API key configuration

MEDIUM Published 2026-01-12 Modified 2026-01-12 Official page ↗
Aliases
CVE-2026-22251
Ecosystem
PyPI
Packages
wlc
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-922
Reviewed
2026-01-12

Affected packages

• PyPI wlc: < 1.17.0 → fixed in 1.17.0

Description

Impact Historically, wlc supported providing unscoped API keys in the setting. This practice was discouraged for years, but the code was never removed. This might cause the API key to be used against different server. Patches • https://github.com/WeblateOrg/wlc/pull/1098 Workarounds Remove unscoped `key` from wlc configuration. Only use URL-scoped keys in the `[keys]` sections. References This issue was reported to us by wh1zee via HackerOne.

Related

Alias · CVE (1)

  • CVE-2026-22251 wlc is a Weblate command-line client using Weblate's REST API. vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-922 Insecure Storage of Sensitive Information weakness

References